* xt_ecn, with descriptions
@ 2011-12-27 18:57 Jan Engelhardt
2011-12-27 18:57 ` [PATCH 1/4] netfilter: xtables: move ipt_ecn to xt_ecn Jan Engelhardt
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: Jan Engelhardt @ 2011-12-27 18:57 UTC (permalink / raw)
To: netfilter-devel
The following changes since commit c5e1fd8ccae09f574d6f978c90c2b968ee29030c:
Merge branch 'nf-next' of git://1984.lsi.us.es/net-next (2011-12-25 02:21:45 -0500)
are available in the git repository at:
git://dev.medozas.de/linux xtecn
Jan Engelhardt (3):
netfilter: xtables: move ipt_ecn to xt_ecn
netfilter: xtables: give xt_ecn its own name
netfilter: xtables: collapse conditions in xt_ecn
Patrick McHardy (1):
netfilter: xtables: add an IPv6 capable version of the ECN match
include/linux/netfilter/Kbuild | 1 +
include/linux/netfilter/xt_ecn.h | 35 ++++++
include/linux/netfilter_ipv4/ipt_ecn.h | 38 ++-----
net/ipv4/netfilter/Kconfig | 10 +-
net/ipv4/netfilter/Makefile | 1 -
net/ipv4/netfilter/ipt_ecn.c | 127 ----------------------
net/netfilter/Kconfig | 9 ++
net/netfilter/Makefile | 1 +
net/netfilter/xt_ecn.c | 179 ++++++++++++++++++++++++++++++++
9 files changed, 239 insertions(+), 162 deletions(-)
create mode 100644 include/linux/netfilter/xt_ecn.h
delete mode 100644 net/ipv4/netfilter/ipt_ecn.c
create mode 100644 net/netfilter/xt_ecn.c
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/4] netfilter: xtables: move ipt_ecn to xt_ecn
2011-12-27 18:57 xt_ecn, with descriptions Jan Engelhardt
@ 2011-12-27 18:57 ` Jan Engelhardt
2011-12-27 18:57 ` [PATCH 2/4] netfilter: xtables: give xt_ecn its own name Jan Engelhardt
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Jan Engelhardt @ 2011-12-27 18:57 UTC (permalink / raw)
To: netfilter-devel
Prepare the ECN match for augmentation by an IPv6 counterpart. Since
no symbol dependencies to ipv6.ko are added, having a single ecn match
module is the more so welcome.
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
---
include/linux/netfilter/Kbuild | 1 +
include/linux/netfilter/xt_ecn.h | 35 ++++++++++++++++++++
include/linux/netfilter_ipv4/ipt_ecn.h | 31 +-----------------
net/ipv4/netfilter/Kconfig | 10 +++---
net/ipv4/netfilter/Makefile | 1 -
net/netfilter/Kconfig | 9 +++++
net/netfilter/Makefile | 1 +
.../netfilter/ipt_ecn.c => netfilter/xt_ecn.c} | 1 +
8 files changed, 53 insertions(+), 36 deletions(-)
create mode 100644 include/linux/netfilter/xt_ecn.h
rename net/{ipv4/netfilter/ipt_ecn.c => netfilter/xt_ecn.c} (99%)
diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild
index e630a2e..e144f54 100644
--- a/include/linux/netfilter/Kbuild
+++ b/include/linux/netfilter/Kbuild
@@ -43,6 +43,7 @@ header-y += xt_cpu.h
header-y += xt_dccp.h
header-y += xt_devgroup.h
header-y += xt_dscp.h
+header-y += xt_ecn.h
header-y += xt_esp.h
header-y += xt_hashlimit.h
header-y += xt_helper.h
diff --git a/include/linux/netfilter/xt_ecn.h b/include/linux/netfilter/xt_ecn.h
new file mode 100644
index 0000000..065c1a5
--- /dev/null
+++ b/include/linux/netfilter/xt_ecn.h
@@ -0,0 +1,35 @@
+/* iptables module for matching the ECN header in IPv4 and TCP header
+ *
+ * (C) 2002 Harald Welte <laforge@gnumonks.org>
+ *
+ * This software is distributed under GNU GPL v2, 1991
+ *
+ * ipt_ecn.h,v 1.4 2002/08/05 19:39:00 laforge Exp
+*/
+#ifndef _XT_ECN_H
+#define _XT_ECN_H
+
+#include <linux/types.h>
+#include <linux/netfilter/xt_dscp.h>
+
+#define IPT_ECN_IP_MASK (~XT_DSCP_MASK)
+
+#define IPT_ECN_OP_MATCH_IP 0x01
+#define IPT_ECN_OP_MATCH_ECE 0x10
+#define IPT_ECN_OP_MATCH_CWR 0x20
+
+#define IPT_ECN_OP_MATCH_MASK 0xce
+
+/* match info */
+struct ipt_ecn_info {
+ __u8 operation;
+ __u8 invert;
+ __u8 ip_ect;
+ union {
+ struct {
+ __u8 ect;
+ } tcp;
+ } proto;
+};
+
+#endif /* _XT_ECN_H */
diff --git a/include/linux/netfilter_ipv4/ipt_ecn.h b/include/linux/netfilter_ipv4/ipt_ecn.h
index eabf95f..b1124ec 100644
--- a/include/linux/netfilter_ipv4/ipt_ecn.h
+++ b/include/linux/netfilter_ipv4/ipt_ecn.h
@@ -1,35 +1,6 @@
-/* iptables module for matching the ECN header in IPv4 and TCP header
- *
- * (C) 2002 Harald Welte <laforge@gnumonks.org>
- *
- * This software is distributed under GNU GPL v2, 1991
- *
- * ipt_ecn.h,v 1.4 2002/08/05 19:39:00 laforge Exp
-*/
#ifndef _IPT_ECN_H
#define _IPT_ECN_H
-#include <linux/types.h>
-#include <linux/netfilter/xt_dscp.h>
-
-#define IPT_ECN_IP_MASK (~XT_DSCP_MASK)
-
-#define IPT_ECN_OP_MATCH_IP 0x01
-#define IPT_ECN_OP_MATCH_ECE 0x10
-#define IPT_ECN_OP_MATCH_CWR 0x20
-
-#define IPT_ECN_OP_MATCH_MASK 0xce
-
-/* match info */
-struct ipt_ecn_info {
- __u8 operation;
- __u8 invert;
- __u8 ip_ect;
- union {
- struct {
- __u8 ect;
- } tcp;
- } proto;
-};
+#include <linux/netfilter/xt_ecn.h>
#endif /* _IPT_ECN_H */
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 7e1f5cd..53b9c79 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -76,11 +76,11 @@ config IP_NF_MATCH_AH
config IP_NF_MATCH_ECN
tristate '"ecn" match support'
depends on NETFILTER_ADVANCED
- help
- This option adds a `ECN' match, which allows you to match against
- the IPv4 and TCP header ECN fields.
-
- To compile it as a module, choose M here. If unsure, say N.
+ select NETFILTER_XT_MATCH_ECN
+ ---help---
+ This is a backwards-compat option for the user's convenience
+ (e.g. when running oldconfig). It selects
+ CONFIG_NETFILTER_XT_MATCH_ECN.
config IP_NF_MATCH_RPFILTER
tristate '"rpfilter" reverse path filter match support'
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 123dd88..213a462 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -49,7 +49,6 @@ obj-$(CONFIG_IP_NF_SECURITY) += iptable_security.o
# matches
obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o
-obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
obj-$(CONFIG_IP_NF_MATCH_RPFILTER) += ipt_rpfilter.o
# targets
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index bac93ba..20388a9 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -778,6 +778,15 @@ config NETFILTER_XT_MATCH_DSCP
To compile it as a module, choose M here. If unsure, say N.
+config NETFILTER_XT_MATCH_ECN
+ tristate '"ecn" match support'
+ depends on NETFILTER_ADVANCED
+ ---help---
+ This option adds an "ECN" match, which allows you to match against
+ the IPv4 and TCP header ECN fields.
+
+ To compile it as a module, choose M here. If unsure, say N.
+
config NETFILTER_XT_MATCH_ESP
tristate '"esp" match support'
depends on NETFILTER_ADVANCED
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index b2eee4d..40f4c3d 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -81,6 +81,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_CPU) += xt_cpu.o
obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += xt_dccp.o
obj-$(CONFIG_NETFILTER_XT_MATCH_DEVGROUP) += xt_devgroup.o
obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_ECN) += xt_ecn.o
obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
diff --git a/net/ipv4/netfilter/ipt_ecn.c b/net/netfilter/xt_ecn.c
similarity index 99%
rename from net/ipv4/netfilter/ipt_ecn.c
rename to net/netfilter/xt_ecn.c
index 2b57e52..2c198f5 100644
--- a/net/ipv4/netfilter/ipt_ecn.c
+++ b/net/netfilter/xt_ecn.c
@@ -21,6 +21,7 @@
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("Xtables: Explicit Congestion Notification (ECN) flag match for IPv4");
MODULE_LICENSE("GPL");
+MODULE_ALIAS("ipt_ecn");
static inline bool match_ip(const struct sk_buff *skb,
const struct ipt_ecn_info *einfo)
--
1.7.3.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/4] netfilter: xtables: give xt_ecn its own name
2011-12-27 18:57 xt_ecn, with descriptions Jan Engelhardt
2011-12-27 18:57 ` [PATCH 1/4] netfilter: xtables: move ipt_ecn to xt_ecn Jan Engelhardt
@ 2011-12-27 18:57 ` Jan Engelhardt
2011-12-27 18:57 ` [PATCH 3/4] netfilter: xtables: add an IPv6 capable version of the ECN match Jan Engelhardt
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Jan Engelhardt @ 2011-12-27 18:57 UTC (permalink / raw)
To: netfilter-devel
Use the new macro and struct names in xt_ecn.h, and put the old
definitions into a definition-forwarding ipt_ecn.h.
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
---
include/linux/netfilter/xt_ecn.h | 12 +++++-----
include/linux/netfilter_ipv4/ipt_ecn.h | 11 +++++++++-
net/netfilter/xt_ecn.c | 34 ++++++++++++++++----------------
3 files changed, 33 insertions(+), 24 deletions(-)
diff --git a/include/linux/netfilter/xt_ecn.h b/include/linux/netfilter/xt_ecn.h
index 065c1a5..7158fca 100644
--- a/include/linux/netfilter/xt_ecn.h
+++ b/include/linux/netfilter/xt_ecn.h
@@ -12,16 +12,16 @@
#include <linux/types.h>
#include <linux/netfilter/xt_dscp.h>
-#define IPT_ECN_IP_MASK (~XT_DSCP_MASK)
+#define XT_ECN_IP_MASK (~XT_DSCP_MASK)
-#define IPT_ECN_OP_MATCH_IP 0x01
-#define IPT_ECN_OP_MATCH_ECE 0x10
-#define IPT_ECN_OP_MATCH_CWR 0x20
+#define XT_ECN_OP_MATCH_IP 0x01
+#define XT_ECN_OP_MATCH_ECE 0x10
+#define XT_ECN_OP_MATCH_CWR 0x20
-#define IPT_ECN_OP_MATCH_MASK 0xce
+#define XT_ECN_OP_MATCH_MASK 0xce
/* match info */
-struct ipt_ecn_info {
+struct xt_ecn_info {
__u8 operation;
__u8 invert;
__u8 ip_ect;
diff --git a/include/linux/netfilter_ipv4/ipt_ecn.h b/include/linux/netfilter_ipv4/ipt_ecn.h
index b1124ec..0e0c063 100644
--- a/include/linux/netfilter_ipv4/ipt_ecn.h
+++ b/include/linux/netfilter_ipv4/ipt_ecn.h
@@ -2,5 +2,14 @@
#define _IPT_ECN_H
#include <linux/netfilter/xt_ecn.h>
+#define ipt_ecn_info xt_ecn_info
-#endif /* _IPT_ECN_H */
+enum {
+ IPT_ECN_IP_MASK = XT_ECN_IP_MASK,
+ IPT_ECN_OP_MATCH_IP = XT_ECN_OP_MATCH_IP,
+ IPT_ECN_OP_MATCH_ECE = XT_ECN_OP_MATCH_ECE,
+ IPT_ECN_OP_MATCH_CWR = XT_ECN_OP_MATCH_CWR,
+ IPT_ECN_OP_MATCH_MASK = XT_ECN_OP_MATCH_MASK,
+};
+
+#endif /* IPT_ECN_H */
diff --git a/net/netfilter/xt_ecn.c b/net/netfilter/xt_ecn.c
index 2c198f5..3ebb3dc 100644
--- a/net/netfilter/xt_ecn.c
+++ b/net/netfilter/xt_ecn.c
@@ -15,8 +15,8 @@
#include <linux/tcp.h>
#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_ecn.h>
#include <linux/netfilter_ipv4/ip_tables.h>
-#include <linux/netfilter_ipv4/ipt_ecn.h>
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
MODULE_DESCRIPTION("Xtables: Explicit Congestion Notification (ECN) flag match for IPv4");
@@ -24,14 +24,14 @@ MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_ecn");
static inline bool match_ip(const struct sk_buff *skb,
- const struct ipt_ecn_info *einfo)
+ const struct xt_ecn_info *einfo)
{
- return ((ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect) ^
- !!(einfo->invert & IPT_ECN_OP_MATCH_IP);
+ return ((ip_hdr(skb)->tos & XT_ECN_IP_MASK) == einfo->ip_ect) ^
+ !!(einfo->invert & XT_ECN_OP_MATCH_IP);
}
static inline bool match_tcp(const struct sk_buff *skb,
- const struct ipt_ecn_info *einfo,
+ const struct xt_ecn_info *einfo,
bool *hotdrop)
{
struct tcphdr _tcph;
@@ -46,8 +46,8 @@ static inline bool match_tcp(const struct sk_buff *skb,
return false;
}
- if (einfo->operation & IPT_ECN_OP_MATCH_ECE) {
- if (einfo->invert & IPT_ECN_OP_MATCH_ECE) {
+ if (einfo->operation & XT_ECN_OP_MATCH_ECE) {
+ if (einfo->invert & XT_ECN_OP_MATCH_ECE) {
if (th->ece == 1)
return false;
} else {
@@ -56,8 +56,8 @@ static inline bool match_tcp(const struct sk_buff *skb,
}
}
- if (einfo->operation & IPT_ECN_OP_MATCH_CWR) {
- if (einfo->invert & IPT_ECN_OP_MATCH_CWR) {
+ if (einfo->operation & XT_ECN_OP_MATCH_CWR) {
+ if (einfo->invert & XT_ECN_OP_MATCH_CWR) {
if (th->cwr == 1)
return false;
} else {
@@ -71,13 +71,13 @@ static inline bool match_tcp(const struct sk_buff *skb,
static bool ecn_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
- const struct ipt_ecn_info *info = par->matchinfo;
+ const struct xt_ecn_info *info = par->matchinfo;
- if (info->operation & IPT_ECN_OP_MATCH_IP)
+ if (info->operation & XT_ECN_OP_MATCH_IP)
if (!match_ip(skb, info))
return false;
- if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)) {
+ if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR)) {
if (!match_tcp(skb, info, &par->hotdrop))
return false;
}
@@ -87,16 +87,16 @@ static bool ecn_mt(const struct sk_buff *skb, struct xt_action_param *par)
static int ecn_mt_check(const struct xt_mtchk_param *par)
{
- const struct ipt_ecn_info *info = par->matchinfo;
+ const struct xt_ecn_info *info = par->matchinfo;
const struct ipt_ip *ip = par->entryinfo;
- if (info->operation & IPT_ECN_OP_MATCH_MASK)
+ if (info->operation & XT_ECN_OP_MATCH_MASK)
return -EINVAL;
- if (info->invert & IPT_ECN_OP_MATCH_MASK)
+ if (info->invert & XT_ECN_OP_MATCH_MASK)
return -EINVAL;
- if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR) &&
+ if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) &&
(ip->proto != IPPROTO_TCP || ip->invflags & IPT_INV_PROTO)) {
pr_info("cannot match TCP bits in rule for non-tcp packets\n");
return -EINVAL;
@@ -109,7 +109,7 @@ static struct xt_match ecn_mt_reg __read_mostly = {
.name = "ecn",
.family = NFPROTO_IPV4,
.match = ecn_mt,
- .matchsize = sizeof(struct ipt_ecn_info),
+ .matchsize = sizeof(struct xt_ecn_info),
.checkentry = ecn_mt_check,
.me = THIS_MODULE,
};
--
1.7.3.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 3/4] netfilter: xtables: add an IPv6 capable version of the ECN match
2011-12-27 18:57 xt_ecn, with descriptions Jan Engelhardt
2011-12-27 18:57 ` [PATCH 1/4] netfilter: xtables: move ipt_ecn to xt_ecn Jan Engelhardt
2011-12-27 18:57 ` [PATCH 2/4] netfilter: xtables: give xt_ecn its own name Jan Engelhardt
@ 2011-12-27 18:57 ` Jan Engelhardt
2011-12-27 18:57 ` [PATCH 4/4] netfilter: xtables: collapse conditions in xt_ecn Jan Engelhardt
2011-12-27 19:33 ` xt_ecn, with descriptions Pablo Neira Ayuso
4 siblings, 0 replies; 6+ messages in thread
From: Jan Engelhardt @ 2011-12-27 18:57 UTC (permalink / raw)
To: netfilter-devel
From: Patrick McHardy <kaber@trash.net>
References: http://www.spinics.net/lists/netfilter-devel/msg18875.html
Augment xt_ecn by facilities to match on IPv6 packets' DSCP/TOS field
similar to how it is already done for the IPv4 packet field.
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
---
net/netfilter/xt_ecn.c | 106 ++++++++++++++++++++++++++++++++++++------------
1 files changed, 80 insertions(+), 26 deletions(-)
diff --git a/net/netfilter/xt_ecn.c b/net/netfilter/xt_ecn.c
index 3ebb3dc..6ccc35d 100644
--- a/net/netfilter/xt_ecn.c
+++ b/net/netfilter/xt_ecn.c
@@ -1,6 +1,8 @@
-/* IP tables module for matching the value of the IPv4 and TCP ECN bits
+/*
+ * Xtables module for matching the value of the IPv4/IPv6 and TCP ECN bits
*
* (C) 2002 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2011 Patrick McHardy <kaber@trash.net>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
@@ -17,32 +19,25 @@
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_ecn.h>
#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
-MODULE_DESCRIPTION("Xtables: Explicit Congestion Notification (ECN) flag match for IPv4");
+MODULE_DESCRIPTION("Xtables: Explicit Congestion Notification (ECN) flag match");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_ecn");
+MODULE_ALIAS("ip6t_ecn");
-static inline bool match_ip(const struct sk_buff *skb,
- const struct xt_ecn_info *einfo)
-{
- return ((ip_hdr(skb)->tos & XT_ECN_IP_MASK) == einfo->ip_ect) ^
- !!(einfo->invert & XT_ECN_OP_MATCH_IP);
-}
-
-static inline bool match_tcp(const struct sk_buff *skb,
- const struct xt_ecn_info *einfo,
- bool *hotdrop)
+static bool match_tcp(const struct sk_buff *skb, struct xt_action_param *par)
{
+ const struct xt_ecn_info *einfo = par->matchinfo;
struct tcphdr _tcph;
const struct tcphdr *th;
/* In practice, TCP match does this, so can't fail. But let's
* be good citizens.
*/
- th = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
+ th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);
if (th == NULL) {
- *hotdrop = false;
return false;
}
@@ -69,7 +64,14 @@ static inline bool match_tcp(const struct sk_buff *skb,
return true;
}
-static bool ecn_mt(const struct sk_buff *skb, struct xt_action_param *par)
+static inline bool match_ip(const struct sk_buff *skb,
+ const struct xt_ecn_info *einfo)
+{
+ return ((ip_hdr(skb)->tos & XT_ECN_IP_MASK) == einfo->ip_ect) ^
+ !!(einfo->invert & XT_ECN_OP_MATCH_IP);
+}
+
+static bool ecn_mt4(const struct sk_buff *skb, struct xt_action_param *par)
{
const struct xt_ecn_info *info = par->matchinfo;
@@ -78,14 +80,14 @@ static bool ecn_mt(const struct sk_buff *skb, struct xt_action_param *par)
return false;
if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR)) {
- if (!match_tcp(skb, info, &par->hotdrop))
+ if (!match_tcp(skb, par))
return false;
}
return true;
}
-static int ecn_mt_check(const struct xt_mtchk_param *par)
+static int ecn_mt_check4(const struct xt_mtchk_param *par)
{
const struct xt_ecn_info *info = par->matchinfo;
const struct ipt_ip *ip = par->entryinfo;
@@ -105,23 +107,75 @@ static int ecn_mt_check(const struct xt_mtchk_param *par)
return 0;
}
-static struct xt_match ecn_mt_reg __read_mostly = {
- .name = "ecn",
- .family = NFPROTO_IPV4,
- .match = ecn_mt,
- .matchsize = sizeof(struct xt_ecn_info),
- .checkentry = ecn_mt_check,
- .me = THIS_MODULE,
+static inline bool match_ipv6(const struct sk_buff *skb,
+ const struct xt_ecn_info *einfo)
+{
+ return (((ipv6_hdr(skb)->flow_lbl[0] >> 4) & XT_ECN_IP_MASK) ==
+ einfo->ip_ect) ^
+ !!(einfo->invert & XT_ECN_OP_MATCH_IP);
+}
+
+static bool ecn_mt6(const struct sk_buff *skb, struct xt_action_param *par)
+{
+ const struct xt_ecn_info *info = par->matchinfo;
+
+ if (info->operation & XT_ECN_OP_MATCH_IP && !match_ipv6(skb, info))
+ return false;
+
+ if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) &&
+ !match_tcp(skb, par))
+ return false;
+
+ return true;
+}
+
+static int ecn_mt_check6(const struct xt_mtchk_param *par)
+{
+ const struct xt_ecn_info *info = par->matchinfo;
+ const struct ip6t_ip6 *ip = par->entryinfo;
+
+ if (info->operation & XT_ECN_OP_MATCH_MASK)
+ return -EINVAL;
+
+ if (info->invert & XT_ECN_OP_MATCH_MASK)
+ return -EINVAL;
+
+ if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) &&
+ (ip->proto != IPPROTO_TCP || ip->invflags & IP6T_INV_PROTO)) {
+ pr_info("cannot match TCP bits in rule for non-tcp packets\n");
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
+static struct xt_match ecn_mt_reg[] __read_mostly = {
+ {
+ .name = "ecn",
+ .family = NFPROTO_IPV4,
+ .match = ecn_mt4,
+ .matchsize = sizeof(struct xt_ecn_info),
+ .checkentry = ecn_mt_check4,
+ .me = THIS_MODULE,
+ },
+ {
+ .name = "ecn",
+ .family = NFPROTO_IPV6,
+ .match = ecn_mt6,
+ .matchsize = sizeof(struct xt_ecn_info),
+ .checkentry = ecn_mt_check6,
+ .me = THIS_MODULE,
+ },
};
static int __init ecn_mt_init(void)
{
- return xt_register_match(&ecn_mt_reg);
+ return xt_register_matches(ecn_mt_reg, ARRAY_SIZE(ecn_mt_reg));
}
static void __exit ecn_mt_exit(void)
{
- xt_unregister_match(&ecn_mt_reg);
+ xt_unregister_matches(ecn_mt_reg, ARRAY_SIZE(ecn_mt_reg));
}
module_init(ecn_mt_init);
--
1.7.3.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 4/4] netfilter: xtables: collapse conditions in xt_ecn
2011-12-27 18:57 xt_ecn, with descriptions Jan Engelhardt
` (2 preceding siblings ...)
2011-12-27 18:57 ` [PATCH 3/4] netfilter: xtables: add an IPv6 capable version of the ECN match Jan Engelhardt
@ 2011-12-27 18:57 ` Jan Engelhardt
2011-12-27 19:33 ` xt_ecn, with descriptions Pablo Neira Ayuso
4 siblings, 0 replies; 6+ messages in thread
From: Jan Engelhardt @ 2011-12-27 18:57 UTC (permalink / raw)
To: netfilter-devel
One simplifcation of an if clause.
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
---
net/netfilter/xt_ecn.c | 15 ++++++---------
1 files changed, 6 insertions(+), 9 deletions(-)
diff --git a/net/netfilter/xt_ecn.c b/net/netfilter/xt_ecn.c
index 6ccc35d..3c831a8 100644
--- a/net/netfilter/xt_ecn.c
+++ b/net/netfilter/xt_ecn.c
@@ -37,9 +37,8 @@ static bool match_tcp(const struct sk_buff *skb, struct xt_action_param *par)
* be good citizens.
*/
th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph);
- if (th == NULL) {
+ if (th == NULL)
return false;
- }
if (einfo->operation & XT_ECN_OP_MATCH_ECE) {
if (einfo->invert & XT_ECN_OP_MATCH_ECE) {
@@ -75,14 +74,12 @@ static bool ecn_mt4(const struct sk_buff *skb, struct xt_action_param *par)
{
const struct xt_ecn_info *info = par->matchinfo;
- if (info->operation & XT_ECN_OP_MATCH_IP)
- if (!match_ip(skb, info))
- return false;
+ if (info->operation & XT_ECN_OP_MATCH_IP && !match_ip(skb, info))
+ return false;
- if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR)) {
- if (!match_tcp(skb, par))
- return false;
- }
+ if (info->operation & (XT_ECN_OP_MATCH_ECE | XT_ECN_OP_MATCH_CWR) &&
+ !match_tcp(skb, par))
+ return false;
return true;
}
--
1.7.3.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: xt_ecn, with descriptions
2011-12-27 18:57 xt_ecn, with descriptions Jan Engelhardt
` (3 preceding siblings ...)
2011-12-27 18:57 ` [PATCH 4/4] netfilter: xtables: collapse conditions in xt_ecn Jan Engelhardt
@ 2011-12-27 19:33 ` Pablo Neira Ayuso
4 siblings, 0 replies; 6+ messages in thread
From: Pablo Neira Ayuso @ 2011-12-27 19:33 UTC (permalink / raw)
To: Jan Engelhardt; +Cc: netfilter-devel
On Tue, Dec 27, 2011 at 07:57:48PM +0100, Jan Engelhardt wrote:
>
> The following changes since commit c5e1fd8ccae09f574d6f978c90c2b968ee29030c:
>
> Merge branch 'nf-next' of git://1984.lsi.us.es/net-next (2011-12-25 02:21:45 -0500)
>
> are available in the git repository at:
>
> git://dev.medozas.de/linux xtecn
>
> Jan Engelhardt (3):
> netfilter: xtables: move ipt_ecn to xt_ecn
> netfilter: xtables: give xt_ecn its own name
> netfilter: xtables: collapse conditions in xt_ecn
>
> Patrick McHardy (1):
> netfilter: xtables: add an IPv6 capable version of the ECN match
Applied, thanks.
http://1984.lsi.us.es/git/net-next/
I'm compiling and testing this, I'll try to pass it to davem asap.
Let's see if we reach the merge window.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2011-12-27 19:33 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-12-27 18:57 xt_ecn, with descriptions Jan Engelhardt
2011-12-27 18:57 ` [PATCH 1/4] netfilter: xtables: move ipt_ecn to xt_ecn Jan Engelhardt
2011-12-27 18:57 ` [PATCH 2/4] netfilter: xtables: give xt_ecn its own name Jan Engelhardt
2011-12-27 18:57 ` [PATCH 3/4] netfilter: xtables: add an IPv6 capable version of the ECN match Jan Engelhardt
2011-12-27 18:57 ` [PATCH 4/4] netfilter: xtables: collapse conditions in xt_ecn Jan Engelhardt
2011-12-27 19:33 ` xt_ecn, with descriptions Pablo Neira Ayuso
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.